verify=recipient/callout,hold fails in 4.99

After Exim upgrade from 4.98 to 4.99.3
I got 5 min timeouts sending to different recipient hosts:

2026-05-14 08:48:10 +0300 1wNOqj-00000000OI7-3ogn H=mxs.mail.ru [217.69.139.150]: SMTP timeout after STARTTLS: Operation timed out
2026-05-14 11:18:43 +0300 1wNRCR-00000000OpT-0ME3 H=lb02.groups.io [173.255.221.194]: SMTP timeout after STARTTLS: Operation timed out
2026-05-14 16:35:55 +0300 1wNW9P-00000000PnY-34Cm H=gmail-smtp-in.l.google.com [173.194.76.26]: SMTP timeout after STARTTLS: Operation timed out

Second attempt succeeds:

2026-05-14 16:30:55 +0300 1wNW9P-00000000PnY-34Cm <= Lena @ lena.kiev.ua H=redacted P=esmtpsa X=TLS1.3:TLS_AES_256_GCM_SHA384:256 A=login:redacted S=1783 RT=0s id=redacted
2026-05-14 16:35:55 +0300 1wNW9P-00000000PnY-34Cm H=gmail-smtp-in.l.google.com [173.194.76.26]: SMTP timeout after STARTTLS: Operation timed out
2026-05-14 16:35:56 +0300 1wNW9P-00000000PnY-34Cm => redacted @ gmail.com R=remote_domains T=remote_smtp H=alt1.gmail-smtp-in.l.google.com [192.178.213.27] I=[185.45.113.66] X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=yes C="250 2.0.0 OK  1778765756 4fb4d7f45d1cf-6831165e005si1509222a12.253 - gsmtp" QT=5m DT=0s
2026-05-14 16:35:56 +0300 1wNW9P-00000000PnY-34Cm Completed QT=5m

No such error messages before this today upgrade since 2009.
Same VPS in Netherlands, FreeBSD 14.4-RELEASE-p3 amd64, OpenSSL 3.0.20,
the only SSL-related options in Exim config: tls_certificate, tls_privatekey,
tls_dhparam (never changed). Port 25 not mentioned in ipfw.

Support for: Content_Scanning Exim_filter Sieve_filter crypteq Expand_dlfunc iconv() PAM OpenSSL TLS_resume use_setclassresources DKIM ESMTP_Limits ESMTP_Wellknown Event PIPECONNECT Queue_Ramp TCP_Fast_Open

I added into beginning of acl_check_rcpt:

  warn  local_parts = lena
        domains = groups.io
        control = debug/tag=.$message_exim_id/opts=+tls+transport+deliver

deleted callout db, sent a test message, read debug logs and suspect
that the problem with 4.99 is triggered by the "hold" in my acl_check_rcpt:

  accept authenticated = *
       !verify = recipient/defer_ok/callout=10s,defer_ok,use_sender\
         ${if forany{${lookup dnsdb{>: defer_never,mxh=$domain}}}\
         {match{$item}{\N\.(outlook.com|yahoodns.net)$\N}}{}{,hold}}

Excerpts from debug log on 4.99.3 with "hold",
I guess that the "no TLS" in "continued connection, no TLS" is wrong:

-----

Attempting full verification using callout

 Connecting to lb01.groups.io [45.79.81.153]:25 ...

 connected
 read response data: size=27
   SMTP<< 220 groups.io ESMTP ready
 45.79.81.153 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO lena.kiev.ua
 cmd buf flush 19 bytes
 read response data: size=49
   SMTP<< 250-groups.io
          250-SIZE 100000000
          250 STARTTLS

   SMTP>> STARTTLS
 cmd buf flush 10 bytes
 read response data: size=21
   SMTP<< 220 2.0.0 Start TLS

   SMTP>> EHLO lena.kiev.ua
 cmd buf flush 19 bytes
tls_write(0x19d662eb5c90, 19)
SSL_write(0x19d662eb8000, 0x19d662eb5c90, 19)
outbytes=19 error=0
Calling SSL_read(0x19d662eb8000, 0x19d662eb4c90, 4096)
 read response data: size=35
   SMTP<< 250-groups.io
          250 SIZE 100000000
not using PIPELINING
not using DSN
 45.79.81.153 in hosts_require_auth?
  list element: smtp.gmail.com
gethostbyname looked up these IP addresses:
  name=smtp.gmail.com address=142.251.127.109
 45.79.81.153 in hosts_require_auth? no (end of list)
   SMTP>> MAIL FROM:<[email protected]>
 cmd buf flush 31 bytes
tls_write(0x19d662eb5c90, 31)
SSL_write(0x19d662eb8000, 0x19d662eb5c90, 31)
outbytes=31 error=0
Calling SSL_read(0x19d662eb8000, 0x19d662eb4c90, 4096)
 read response data: size=14
   SMTP<< 250 2.0.0 OK
   SMTP>> RCPT TO:<[email protected]>
 cmd buf flush 26 bytes
tls_write(0x19d662eb5c90, 26)
SSL_write(0x19d662eb8000, 0x19d662eb5c90, 26)
outbytes=26 error=0
sync_responses expect rcpt for [email protected]
Calling SSL_read(0x19d662eb8000, 0x19d662eb4c90, 4096)
 read response data: size=14
   SMTP<< 250 Accepted
 holding verify callout open for potential further verifies and delivery

remote_smtp transport entered

already connected to lb01.groups.io [45.79.81.153]:25 (on fd 0)

set_process_info:   127 delivering 1wNXGy-0000000001x-19ZZ to lb01.groups.io [45.79.81.153] ([email protected])
continued connection, no TLS
45.79.81.153 in hosts_avoid_tls? no (option unset)
  SMTP>> STARTTLS
cmd buf flush 10 bytes
tls_write(0x19d662471708, 10)
SSL_write(0x19d662eb8000, 0x19d662471708, 10)
outbytes=10 error=0

polling subprocess pipes
polling subprocess pipes
polling subprocess pipes
polling subprocess pipes
smtp_proxy_tls: timed out
 search_tidyup called
>>>>>>>>>>>>>>>> Exim pid=126 (tls-proxy) terminating with rc=0 >>>>>>>>>>>>>>>>
  SMTP(Operation timed out)<<
  SMTP(close)>>
cmdlog: 'STARTTLS'
LOG: MAIN
  H=lb01.groups.io [45.79.81.153]: SMTP timeout after STARTTLS: Operation timed out

-----

Excerpts from debug log on 4.98.2 with "hold" (working correctly):

-----

remote_smtp transport entered

already connected to lb02.groups.io [173.255.221.194] (on fd 0)

set_process_info:  4502 delivering 1wNZMY-000000001AW-2Hrr to lb02.groups.io [173.255.221.194] ([email protected])
continued connection, proxied TLS
  SMTP>> DATA
cmd buf flush 6 bytes
tls_write(0x2d3d26071608, 6)
SSL_write(0x2d3d26a61000, 0x2d3d26071608, 6)
outbytes=6 error=0
sync_responses expect data

-----

I'm ready to email full debug logs to a developer.